CVE-2025-4423
SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption
- State
- Published
- Severity
- 8.2 High
- Published
- Jul 30, 2025
- Updated
- Aug 14, 2025
- Reserved
- May 8, 2025
Description
The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | Insyde |
Weaknesses
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected Products
| Product | Versions |
|---|---|
InsydeH2OInsyde Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.